Skip to content

User enumeration in authentication mechanisms

Low severity GitHub Reviewed Published May 14, 2021 in lexik/LexikJWTAuthenticationBundle • Updated Jan 9, 2023

Package

composer lexik/jwt-authentication-bundle (Composer)

Affected versions

< 2.10.7
>= 2.11.0, < 2.11.3

Patched versions

2.10.7
2.11.3

Description

Description

The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not.

Resolution

We now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist.

The patch for this issue is available here for branch 2.10.x and 2.x.

Credits

I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.

References

@chalasr chalasr published to lexik/LexikJWTAuthenticationBundle May 14, 2021
Reviewed May 17, 2021
Published to the GitHub Advisory Database May 17, 2021
Last updated Jan 9, 2023

Severity

Low

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-2frx-j9hj-6c65

Source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.